Force user to change password when expired

**Is your feature request related to a problem? Please describe.**
Right now we are not enforcing expired passwords. We need a way to require a user to change their password when attempting to log in with an expired password.

**Describe the solution you'd like**
Update the /token api route to check if the user's password is expired (after validating the password is correct).
If password is expired, return a message back to the caller that the password is expired.

The UI will catch this message and if presented, it will redirect the user to a new change password page where they will need to enter their old password, and their new password.

This UI page will post to a new API route to reset the user's password. This might be the /me route, not sure at this time. This new API route will check to make sure the old password is valid, if so, it will hash the new password with the salt+pepper and store it in the users collection.
We need to verify the user being modified is themselves, so no way another use can use this route to change another user's password.

**Describe alternatives you've considered**
Can this be the same page as the normal change password page that we would offer the user when they just want to change their password?
If so, we would need to put some protections on each page of the UI so they can only get to this one route.
Because of this, I think it should be a separate page, where they can _only_ change their password.

**Additional context**
None

從 /token API 路由開始，追蹤密碼驗證和密碼過期狀態的處理方式。在決定 endpoint 和存取保護措施之前，檢查可能的 /me 路由以及所述的 UI 流程。完成的標準是：有效驗證後回報密碼已過期，使用者可以安全地只變更自己的密碼，且新密碼依指定方式儲存。

由索引模型根據 Issue 內容生成。